IBM OpenBMC bmcweb HTTPS server (FW1050.00 - FW1050.10): Certain URIs on IBM's OpenBMC-derived bmcweb return

Impact

Certain URIs on IBM's OpenBMC-derived bmcweb return their content to callers who never authenticated. The Redfish tree is where BMC-side inventory lives - serial numbers, firmware versions, sensor and account metadata - so an unauthenticated reader on the management VLAN gets a precise map of the fleet: which nodes run which firmware, and therefore which nodes are still vulnerable to everything else in this cluster. It is reconnaissance rather than control, but it is the reconnaissance that makes a targeted BMC campaign cheap.

Who can reach it

Unauthenticated HTTPS to the BMC's Redfish/web endpoint. Any host that can route to the management network.

What to do

Fixed in IBM firmware after FW1050.10; delivery is an OpenPower/Power system firmware update, which on IBM hardware is a supported in-band update path rather than a raw SPI flash, but still a per-node reboot-class operation with a maintenance window. Config-only first move: confirm no BMC in the fleet answers HTTPS from outside your management VLAN, and treat any Redfish data reachable pre-auth as public.

References